0

I have been dealing with this issue a number of different times now, and each time I work on it I can not determine a solution. I have searched these forums, my firewall forums and worked with a few firewall admins, as well as working with the manufacture support. I have a number of Reolink E1 Zoom cameras that have an FTP function both locally (site1), and remotely (site2). These cameras are not capable of SFTP. In working with the folks on the firewall forums the firewall does not seem to be blocking anything as all rules are right, and we can see traffic to the server.

  1. I have a locally hosted FTP server (Windows Server 2016) that I want to send all camera FTP files to that sits behind my pfsense firewall.
  2. I have setup my FTP server bound to port 50022 in passive mode with ports 49152-65534 configured.
  3. I have a NAT port forward rule set to any source address, or dest address, on source or dest port 50022,ports 49152-65534 and to a NAT IP of my local LAN FTP server (site1).
  4. If I point to my public IP address for the remote devices (site2), I continue to get FTP test failed, and I only see 3 packets of traffic on my wireshark capture (on the server hosting the FTP) isolated to the src ip address. The traffic is coming in on the correct port 50022, with 1 syn, and then 2 retransmitted syn packs. Screenshot of Wireshark capture I never see the server respond with a syn/ack to the remote (site2). It works fine with the local devices.
  5. I have tried disabling tcp timestamps as some have suggested, I have ensured TCP V6 is off, I have disabled server side window scaling. Originally I was using the IIS FTP, I switched to Filezilla with the same results. Any ideas?

Thank you,

6
  • 1
    If the cameras do not support SFTP, you should create an encrypted tunnel between the two sites and forget about the NAT problem. The tunnel will look just like a direct link between the two sites, but you can have it encrypted, e.g. SSH, because you do not want snoopers being able to capture raw camera footage.
    – Ron Maupin
    Sep 22, 2022 at 3:37
  • Hello @RonMaupin, Thank you for the response. I am unable to think of a way that this could be completed. The remote location (site2) does not have a firewall or any other means of making this connection. There is a consumer cable modem, with a consumer wireless router, and 6 cameras.
    – VEnArdoP
    Sep 22, 2022 at 20:29
  • Even putting in a consumer-grade router would let you do that as many consumer-grade routers support such tunnels. If your business depends on that site, you are really too vulnerable with its current setup.
    – Ron Maupin
    Sep 22, 2022 at 20:34
  • Hello @RonMaupin, I am looking at building a pfsense box for this location. This remote location is not a business, but a property with cameras. I did find that although I have explicit allow rules on the host firewall, it looks like it is dropping the packets? I did change everything back to port 21 for testing. [link] (drive.google.com/file/d/191bFYXsLirg1wwcppcQP05SNsknzuoYC/…) and {link] (drive.google.com/file/d/191bFYXsLirg1wwcppcQP05SNsknzuoYC/…)
    – VEnArdoP
    Sep 23, 2022 at 21:41
  • Questions here must be "about managing information technology systems in a business environment." You could ask your question on Super User.
    – Ron Maupin
    Sep 23, 2022 at 21:51

0

You must log in to answer this question.

Browse other questions tagged .